VDB
Sign up
HIGH7.5

PYSEC-2026-107

Quick fix

PYSEC-2026-107 — orjson: upgrade to the fixed version with the command below.

pip install --upgrade 'orjson>=3.11.5'

Details

The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/orjson
Introduced in: 0Fixed in: 3.11.5
Fixpip install --upgrade 'orjson>=3.11.5'

References